System Binary Proxy Execution: Mshta T1218.005

Events covered

10 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 55 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (39 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (548 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (183 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 8 rules

• Csc.EXE Execution Form Potentially Suspicious Parent
• HackTool - CACTUSTORCH Remote Thread Creation
• MSHTA Execution with Suspicious File Extensions
• Potential Baby Shark Malware Activity
• Potential LethalHTA Technique Execution
• Remotely Hosted HTA File Executed Via Mshta.EXE
• Suspicious JavaScript Execution Via Mshta.EXE
• Suspicious MSHTA Child Process

Elastic 26 rules

• Command and Scripting Interpreter via Windows Scripts
• Delayed Execution via Ping
• Execution from Unusual Directory - Command Line
• Execution of a Downloaded Windows Script
• Execution of Persistent Suspicious Program
• Incoming DCOM Lateral Movement via MSHTA
• Microsoft Build Engine Started by a Script Process
• Mshta Making Network Connections
• Potential Execution via FileFix Phishing Attack
• Potential Fake CAPTCHA Phishing Attack
• Process Activity via Compiled HTML File
• Script Execution via Microsoft HTML Application
• Service Control Spawned via Script Interpreter
• Suspicious .NET Code Compilation
• Suspicious Execution from a Mounted Device
• Suspicious Execution from VS Code Extension
• Suspicious Explorer Child Process
• Suspicious JetBrains TeamCity Child Process
• Suspicious Managed Code Hosting Process
• Suspicious Microsoft HTML Application Child Process
• Suspicious MS Office Child Process
• Suspicious MS Outlook Child Process
• Suspicious PDF Reader Child Process
• Suspicious ScreenConnect Client Child Process
• Suspicious Windows Command Shell Arguments
• Unusual Network Activity from a Windows System Binary

Splunk 20 rules

• Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI
• Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download
• Detect mshta inline hta execution
• Detect mshta renamed
• Detect MSHTA Url in Command Line
• Detect Rundll32 Inline HTA Execution
• Mshta spawning Rundll32 OR Regsvr32 Process
• MSHTA.exe execution (PowerShell)
• MSHTA.exe execution (Sysmon)
• MSHTA.exe execution (Windows Event Log)
• mshta.exe File Download (PowerShell)
• mshta.exe File Download (Sysmon)
• mshta.exe File Download (Windows Event Log)
• Suspicious Child Process for mshta.exe (Sysmon)
• Suspicious Child Process for mshta.exe (Windows Event Log)
• Suspicious mshta child process
• Suspicious mshta spawn
• Windows Mshta Execution In Registry
• Windows MSHTA Writing to World Writable Path
• Windows Process Writing File to World Writable Path

Kusto 1 rule

• Script Interpreter Loading DotNet Assembly From Memory